Yes, Impact may be low. But the UserID they are storing in the Cookie, so by social engineering or MITM attacker can steal and get access to another user accounts